Malicious code in code-assist-mcp (npm)
code-assist-mcp@1.0.0 on npm contains malicious postinstall code that exfiltrates host identifiers to a remote server. The package name resembles Google's legitimate code-assist tooling, suggesting a typosquatting or dependency-confusion attack targeting build machines.
- Disclosed
- Last updated
- Blast radius
- Developers and build systems installing code-assist-mcp@1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- code-assist-mcp · 1.0.0
code-assist-mcp@1.0.0 was published to npm with embedded malicious code in its postinstall lifecycle script. Upon installation, the package automatically collects host identifiers including hostname, platform, architecture, Node version, and package name, then POSTs this data as JSON to a hardcoded remote host (m743pyrm.instances.poc.jchunt.top) at the path /code-assist-mcp.
The beacon executes without user opt-in during npm install, affecting any developer or build system that installs the package. The package name closely resembles Google's legitimate platform-ai code-assist tooling, consistent with a typosquatting or dependency-confusion attack designed to confirm code execution on installer machines.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. The attack vector suggests reconnaissance activity targeting build infrastructure.
Indicators of compromise
- Packages
- code-assist-mcp
- Domains
- m743pyrm.instances.poc.jchunt.top
Remediation
- Remove code-assist-mcp from all package.json files and lock files
- Audit npm install logs and build system logs for evidence of installation of code-assist-mcp@1.0.0
- Rotate credentials and secrets that may have been exposed on affected build machines
- Review network logs for connections to m743pyrm.instances.poc.jchunt.top from build infrastructure
- Use npm audit to identify any transitive dependencies on code-assist-mcp
- Consider implementing package allowlisting or stricter dependency review processes to prevent typosquatting attacks
Sources
- GitHub Advisory GHSA-79vg-qvmh-c7h2 · GitHub Advisory Database
Cite this entry
"Malicious code in code-assist-mcp (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-code-assist-mcp-npm-ehc320
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package